insecure-installer

SUSPICIOUS. The skill’s stated purpose is plausible, but its actual footprint relies on unverifiable remote installers, unpinned package execution, and unsafe pickle deserialization. The install paths are not proportionate to a trustworthy dev-tool setup skill and create significant supply-chain and code-execution risk.

This module is highly dangerous from a software supply chain perspective. It directly downloads and executes a remote shell script using `curl ... | bash` under `shell=True` (allowing remote code execution and potentially command injection through tool_name). It also performs unsafe deserialization with `pickle.load` from a predictable user-writable cache file, which can enable arbitrary code execution if the cache is tampered with. Overall, the code exhibits strong indicators of arbitrary code execution capability rather than safe, integrity-checked installation or caching.